diff --git a/.github/workflows/issue_to_jira.yml b/.github/workflows/issue_to_jira.yml
index 64350558a..798252ffd 100644
--- a/.github/workflows/issue_to_jira.yml
+++ b/.github/workflows/issue_to_jira.yml
@@ -9,7 +9,7 @@ permissions: {}
 jobs:
   call-workflow-create-jira-issue:
     if: startsWith(github.repository, 'MiraGeoscience/')  # run on the Mira repo only
-    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-jira-issue_to_jira.yml@v3
+    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-jira-issue_to_jira.yml@89672b26b20a657bed31f84496961abc07166a95 # v3.9.1
     permissions:
       contents: read
       issues: write
diff --git a/.github/workflows/pr_jira_actions.yml b/.github/workflows/pr_jira_actions.yml
index 65299b541..7140e316d 100644
--- a/.github/workflows/pr_jira_actions.yml
+++ b/.github/workflows/pr_jira_actions.yml
@@ -9,7 +9,7 @@ jobs:
     if: |  # run on the Mira repo only
       startsWith(github.repository, 'MiraGeoscience/') &&
       (github.event.action != 'edited' || github.event.changes.title != null)
-    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-jira-pr_actions.yml@v3
+    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-jira-pr_actions.yml@89672b26b20a657bed31f84496961abc07166a95 # v3.9.1
     permissions:
       contents: read
       pull-requests: write
diff --git a/.github/workflows/python_deploy_dev.yml b/.github/workflows/python_deploy_dev.yml
index 38c73c14f..cab3e21a1 100644
--- a/.github/workflows/python_deploy_dev.yml
+++ b/.github/workflows/python_deploy_dev.yml
@@ -32,7 +32,7 @@ jobs:
   call-workflow-conda-publish:
     name: Publish development conda package on JFrog Artifactory
     if: github.repository == 'MiraGeoscience/gempy'
-    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-publish_rattler_package.yml@v3.7.0-alpha.1
+    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-publish_rattler_package.yml@89672b26b20a657bed31f84496961abc07166a95 # v3.9.1
     permissions:
       id-token: write
       contents: write
@@ -51,7 +51,7 @@ jobs:
   call-workflow-pypi-publish:
     name: Publish development pypi package (JFrog Artifactory)
     if: github.repository == 'MiraGeoscience/gempy'
-    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-publish_pypi_package.yml@v3.7.0-alpha.1
+    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-publish_pypi_package.yml@89672b26b20a657bed31f84496961abc07166a95 # v3.9.1
     permissions:
       id-token: write
       contents: write
diff --git a/.github/workflows/python_deploy_prod.yml b/.github/workflows/python_deploy_prod.yml
index 7549215c2..41ed85cba 100644
--- a/.github/workflows/python_deploy_prod.yml
+++ b/.github/workflows/python_deploy_prod.yml
@@ -31,7 +31,7 @@ jobs:
     if: |
       github.repository == 'MiraGeoscience/gempy' &&
       (github.event_name == 'release' || github.event.inputs.publish-conda == 'true')
-    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-release_conda_assets.yml@v3
+    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-release_conda_assets.yml@89672b26b20a657bed31f84496961abc07166a95 # v3.9.1
     permissions:
       id-token: write
       contents: write
@@ -46,7 +46,7 @@ jobs:
     if: |
       github.repository == 'MiraGeoscience/gempy' &&
       (github.event_name == 'release' || github.event.inputs.publish-pypi == 'true')
-    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-release_pypi_assets.yml@v3
+    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-release_pypi_assets.yml@89672b26b20a657bed31f84496961abc07166a95 # v3.9.1
     permissions:
       id-token: write
       contents: write
diff --git a/.github/workflows/security_scan.yml b/.github/workflows/security_scan.yml
index 49675b3f5..75a9ca228 100644
--- a/.github/workflows/security_scan.yml
+++ b/.github/workflows/security_scan.yml
@@ -31,7 +31,7 @@ jobs:
       security-events: write
       contents: read
       actions: read
-    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-zizmor-advanced-security.yml@v3
+    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-zizmor-advanced-security.yml@89672b26b20a657bed31f84496961abc07166a95 # v3.9.1
 
   call-workflow-zizmor-advanced-security:
     name: Zizmor analysis (annotate)
@@ -40,4 +40,4 @@ jobs:
       checks: write
       contents: read
       actions: read
-    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-zizmor-annotate.yml@v3
+    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-zizmor-annotate.yml@89672b26b20a657bed31f84496961abc07166a95 # v3.9.1